MiDeleteInsertedCloneVads
VOID __stdcall MiDeleteInsertedCloneVads(_EPROCESS *Process){
_ETHREAD *CurrentThread;
_MMVAD *v3;
_MMVAD *i;
_MMVAD **v5;
_MMVAD *v6;
_MMVAD *v7;
_MMVAD *v8;
_MMVAD *j;
_MMVAD **v10;
_MMVAD *v11;
_MMVAD *v12;
KAPC_STATE ApcState;
memset(&ApcState, 0, sizeof(ApcState));
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
KiStackAttachProcess((_KPROCESS *)Process, 0i64, &ApcState);
*(_BYTE *)(*((_QWORD *)Process + 210) + 353i64) |= 1u;
v3 = (_MMVAD *)*((_QWORD *)Process + 251);
i = 0i64;
while( v3 )
{
i = v3;
v3 = *(_MMVAD **)v3;
}
while( i )
{
v5 = (_MMVAD **)*((_QWORD *)i + 1);
v6 = i;
v7 = i;
if( v5 )
{
v8 = *v5;
for( i = (_MMVAD *)*((_QWORD *)i + 1); v8; v8 = *(_MMVAD **)v8 )
i = v8;
}
else
{
while( 1 )
{
i = (_MMVAD *)(*((_QWORD *)i + 2) & 0xFFFFFFFFFFFFFFFCui64);
if( !i || *(_MMVAD **)i == v7 )
break;
v7 = i;
}
}
MiLockVad((__int64)CurrentThread, (__int64)v6);
MiReferenceVad((__int64)v6);
MiDeleteVad(v6, 0i64);
}
for( j = (_MMVAD *)*((_QWORD *)Process + 158); j; j = *(_MMVAD **)j )
i = j;
while( i )
{
*((_QWORD *)i + 6) = 0i64;
MiDeleteCloneDescriptor((ULONG_PTR)Process, (__int64)i);
v10 = (_MMVAD **)*((_QWORD *)i + 1);
v11 = i;
if( v10 )
{
v12 = *v10;
for( i = (_MMVAD *)*((_QWORD *)i + 1); v12; v12 = *(_MMVAD **)v12 )
i = v12;
}
else
{
while( 1 )
{
i = (_MMVAD *)(*((_QWORD *)i + 2) & 0xFFFFFFFFFFFFFFFCui64);
if( !i || *(_MMVAD **)i == v11 )
break;
v11 = i;
}
}
}
MiDeleteCloneZombies((INT64)Process, 0i64);
KiUnstackDetachProcess(&ApcState, 0i64);
}Referenced by:
MiCloneProcessAddressSpace